@camstack/system 1.2.81 → 1.2.83

package/dist/{dist-CA2mim74.js → dist-CqiMPPs0.js}

@@ -3305,8 +3305,31 @@ var AdoptionJobSchema = zod.z.object({
 	error: zod.z.string().nullable()
 });
 /**
-* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
-* pipeline functions an operator thinks in terms of.
+* Per-camera FUNCTION SWITCHES.
+*
+* ## The aggregate group is being withdrawn — the BADGE is not (D113)
+*
+* This file shipped as "the one coherent on/off surface over the pipeline
+* functions an operator thinks in terms of". The operator's verdict on
+* 2026-08-12 was that the coherent surface bought complexity and no clarity:
+* every function already had a settings page of its own, and a second place to
+* turn it off is a second place to look. Each switch is going back to its own
+* component's original options — detection to the detection-pipeline wrapper
+* binding, audio analysis to its own, recording to `RecordingConfig.enabled`
+* (which was always first-class; the switch was a veneer over
+* `recording.setDeviceConfig`), notifications to a notification-center
+* per-device setting, the two camera planes to their own components.
+*
+* What survives is {@link composeSwitchedOff}: `CameraStatus.switchedOff`, the
+* thing that lets a status surface say DISABLED instead of BROKEN, recomposed
+* straight from the authorities with no group in the middle. That rule was
+* never about a control panel.
+*
+* Everything else here — {@link CAMERA_SWITCH_CATALOG}, {@link CameraSwitch},
+* {@link deriveCameraSwitches}, the `pipelineOrchestrator.getCameraSwitches` /
+* `setCameraSwitch` pair — is a COMPATIBILITY surface for as long as deployed
+* viewers (v1.0.305) and the admin UI still call it. It is deleted when they
+* stop; nothing new may be built on it.
 *
 * ## This file adds no state
 *
@@ -16538,9 +16561,16 @@ var CameraStatusSchema = zod.z.object({
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
 	/**
-	* Per-camera function switches an OPERATOR has turned off
+	* Per-camera functions an OPERATOR has turned off
 	* ([D61](../../../../docs/decisions/adr-0067.md)).
 	*
+	* Composed from the AUTHORITIES themselves — the wrapper bindings,
+	* `RecordingConfig.enabled`, the notification mute, the broker's audio
+	* policy, the camera's own microphone — via `composeSwitchedOff`, not from
+	* the deprecated `getCameraSwitches` group ([D113](../../../../docs/decisions/adr-0113.md)).
+	* The badge outlives the control panel: the panel was a convenience, this is
+	* the difference between a camera being off and a camera being dead.
+	*
 	* This is the difference between DISABLED and BROKEN. A camera whose
 	* `detection` block reports zero fps and whose `switchedOff` contains
 	* `'object-detection'` was switched off by a person; the same camera with an
@@ -16979,6 +17009,10 @@ var pipelineOrchestratorCapability = {
 			agentNodeId: zod.z.string().optional()
 		}), CameraPipelineConfigSchema),
 		/**
+		* @deprecated The aggregate switch group is being withdrawn
+		* ([D113](../../../../docs/decisions/adr-0113.md)). Build nothing new on
+		* this pair; read the authority directly.
+		*
 		* The whole per-camera function switch group, DERIVED — never a stored
 		* list ([D61](../../../../docs/decisions/adr-0067.md)).
 		*
@@ -16992,9 +17026,23 @@ var pipelineOrchestratorCapability = {
 		* `auth: 'view'` deliberately — a NON-admin must be able to see that a
 		* camera is quiet because somebody switched it off. Only the mutation is
 		* admin-gated.
+		*
+		* **Removal plan.** It stays and it KEEPS WORKING while shipped viewers
+		* (v1.0.305) and the admin UI still call it — removing it now is a broken
+		* app on a device nobody can redeploy from here. It is served by a thin
+		* shim over the same authorities (`camera-switch-service.ts`), so the
+		* behaviour of the pair is the behaviour of the authorities by
+		* construction. It is deleted once every surface reaches its own
+		* component's options and the last caller is gone. Nothing on this server
+		* reads it: `CameraStatus.switchedOff` is composed from the authorities
+		* directly via `composeSwitchedOff`.
 		*/
 		getCameraSwitches: method(zod.z.object({ deviceId: zod.z.number() }), CameraSwitchGroupSchema),
 		/**
+		* @deprecated See {@link getCameraSwitches}. Write the authority — the
+		* wrapper binding, `RecordingConfig.enabled`, the notification mute — not
+		* this ([D113](../../../../docs/decisions/adr-0113.md)).
+		*
 		* Flip ONE switch, routed to its existing authority.
 		*
 		* Never writes a parallel map: `recording` patches `RecordingConfig.enabled`
@@ -25225,7 +25273,7 @@ var recordingCapability = {
 	}
 };
 /**
-* `recordingExport` cap — render a footage time range into a single downloadable
+* `recording-export` cap — render a footage time range into a single downloadable
 * MP4 (regular / accelerated / decelerated / timelapse, ± audio), kept for a
 * bounded lifetime with a durable history, auto-expiry, and optional
 * delete-after-download.
@@ -25240,10 +25288,42 @@ var recordingCapability = {
 */
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = zod.z.number().min(.25).max(32);
+/**
+* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* Relative and not absolute epoch on purpose: the renderer's frame-select
+* expression sees ffmpeg's `t`, which starts at 0 for the export's source
+* playlist. Handing it absolute epochs would make every call site responsible
+* for the same subtraction, and the one that forgot would emit a filter that
+* selects nothing — silently, as a uniform timelapse.
+*/
+var ExportDenseRangeSchema = zod.z.object({
+	fromSec: zod.z.number().nonnegative(),
+	toSec: zod.z.number().nonnegative()
+}).refine((r) => r.toSec > r.fromSec, { message: "dense range must have toSec > fromSec" });
+/**
+* Dense-interval overlay for a timelapse: sample at `dense.everyMs` INSIDE the
+* listed ranges and at the base `everyMs` everywhere else.
+*
+* `everyMs` must be strictly smaller than the base cadence — a dense rate that
+* is not denser renders a uniform timelapse the operator believes is two-rate.
+*/
+var ExportDenseSchema = zod.z.object({
+	everyMs: zod.z.number().int().positive(),
+	ranges: zod.z.array(ExportDenseRangeSchema).min(1).max(200)
+});
 /** Timelapse cadence — sample one source frame per `everyMs`, output at `outputFps`. */
 var ExportTimelapseSchema = zod.z.object({
 	everyMs: zod.z.number().int().positive(),
-	outputFps: zod.z.number().int().min(1).max(60).optional()
+	outputFps: zod.z.number().int().min(1).max(60).optional(),
+	/** Optional second, FASTER rate over the intervals that matter. */
+	dense: ExportDenseSchema.optional()
+}).superRefine((v, ctx) => {
+	if (v.dense !== void 0 && v.dense.everyMs >= v.everyMs) ctx.addIssue({
+		code: zod.z.ZodIssueCode.custom,
+		message: "dense.everyMs must be strictly smaller than the base everyMs",
+		path: ["dense", "everyMs"]
+	});
 });
 /**
 * Render options. `speed` and `timelapse` are mutually exclusive. `includeAudio`
@@ -25301,8 +25381,21 @@ var ExportDownloadSchema = zod.z.object({
 	url: zod.z.string(),
 	endpoints: zod.z.array(zod.z.string())
 });
+/**
+* A finished export's bytes, inline.
+*
+* `bytes` is the DECODED length — the number the caller bounds and logs
+* against, so nobody has to infer it from the base64 length.
+*/
+var ExportBytesSchema = zod.z.object({
+	base64: zod.z.string(),
+	contentType: zod.z.string(),
+	/** Suggested filename, extension included. */
+	name: zod.z.string(),
+	bytes: zod.z.number().int().nonnegative()
+});
 var recordingExportCapability = {
-	name: "recordingExport",
+	name: "recording-export",
 	scope: "system",
 	mode: "singleton",
 	methods: {
@@ -25340,6 +25433,27 @@ var recordingExportCapability = {
 		getDownloadUrl: method(zod.z.object({ exportId: zod.z.string() }), ExportDownloadSchema, {
 			kind: "query",
 			auth: "protected"
+		}),
+		/**
+		* The finished file's BYTES, base64, for a caller that must republish them
+		* somewhere a session-less fetcher can reach.
+		*
+		* `getDownloadUrl` is the right answer for a human: the download route is
+		* served `access: 'authenticated'`, which a browser satisfies and a
+		* notifier BACKEND does not. It answers a RELATIVE path, so it is not even
+		* a URL an outside fetcher could try. This method exists for the one case
+		* that needs the other thing — a scheduled timelapse whose video has to
+		* become a public attachment on the notification artifact plane.
+		*
+		* Deliberately narrow: `ready` only (a queued, rendering, failed, expired
+		* or deleted export has no file, and answering "0 bytes" for one is how a
+		* caller ships an empty attachment), still inside its lifetime, and under
+		* {@link RECORDING_EXPORT_MAX_READ_BYTES}. Every refusal throws with the
+		* reason — none of them is silent.
+		*/
+		readExportBytes: method(zod.z.object({ exportId: zod.z.string() }), ExportBytesSchema, {
+			kind: "query",
+			auth: "protected"
 		})
 	}
 };
@@ -32028,37 +32142,43 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "create"
 	},
 	"recordingExport.cancelExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
 	"recordingExport.createExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
 	"recordingExport.deleteExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
 	"recordingExport.getDownloadUrl": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
 	"recordingExport.getExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
 	"recordingExport.listExports": {
-		capName: "recordingExport",
+		capName: "recording-export",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordingExport.readExportBytes": {
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
@@ -33480,10 +33600,28 @@ TimelapseRuleInputSchema.extend({
 	*/
 	ownerUserId: zod.z.string().optional(),
 	/**
-	* Epoch-ms of the last successful generation — the 1-hour re-generation
-	* guard's durable state (predecessor parity). Absent = never generated.
+	* Epoch-ms of the NEWEST successful generation across every camera of this
+	* rule. What a UI shows, and the compatibility floor for
+	* {@link readTimelapseGeneratedAt}. Absent = never generated.
 	*/
 	lastGeneratedAt: zod.z.number().optional(),
+	/**
+	* PER-CAMERA generation state, keyed by `String(deviceId)` — the
+	* re-generation guard's real durable state.
+	*
+	* One rule covers several cameras and each renders its own video, so a rule
+	* -wide stamp is wrong in the direction that DESTROYS work: camera A
+	* succeeding at 06:05 tells camera B, whose render failed, that it is
+	* already done — and B's night is gone for good, because the window will not
+	* come back.
+	*
+	* ADDITIVE, so the migration is free: a row written before this field simply
+	* has no map, and {@link readTimelapseGeneratedAt} falls back to
+	* {@link TimelapseRuleSchema.shape.lastGeneratedAt}. Reading an old row as
+	* "never generated" would re-render and re-notify every camera of every rule
+	* once, on the deploy that shipped the map.
+	*/
+	generatedByDevice: zod.z.record(zod.z.string(), zod.z.number()).optional(),
 	/** userId of the caller who created the rule (server-stamped). */
 	createdBy: zod.z.string(),
 	createdAt: zod.z.number(),

package/dist/{dist-DZOZtn-0.mjs → dist-EAvNJD24.mjs}

@@ -3305,8 +3305,31 @@ var AdoptionJobSchema = z.object({
 	error: z.string().nullable()
 });
 /**
-* Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
-* pipeline functions an operator thinks in terms of.
+* Per-camera FUNCTION SWITCHES.
+*
+* ## The aggregate group is being withdrawn — the BADGE is not (D113)
+*
+* This file shipped as "the one coherent on/off surface over the pipeline
+* functions an operator thinks in terms of". The operator's verdict on
+* 2026-08-12 was that the coherent surface bought complexity and no clarity:
+* every function already had a settings page of its own, and a second place to
+* turn it off is a second place to look. Each switch is going back to its own
+* component's original options — detection to the detection-pipeline wrapper
+* binding, audio analysis to its own, recording to `RecordingConfig.enabled`
+* (which was always first-class; the switch was a veneer over
+* `recording.setDeviceConfig`), notifications to a notification-center
+* per-device setting, the two camera planes to their own components.
+*
+* What survives is {@link composeSwitchedOff}: `CameraStatus.switchedOff`, the
+* thing that lets a status surface say DISABLED instead of BROKEN, recomposed
+* straight from the authorities with no group in the middle. That rule was
+* never about a control panel.
+*
+* Everything else here — {@link CAMERA_SWITCH_CATALOG}, {@link CameraSwitch},
+* {@link deriveCameraSwitches}, the `pipelineOrchestrator.getCameraSwitches` /
+* `setCameraSwitch` pair — is a COMPATIBILITY surface for as long as deployed
+* viewers (v1.0.305) and the admin UI still call it. It is deleted when they
+* stop; nothing new may be built on it.
 *
 * ## This file adds no state
 *
@@ -16538,9 +16561,16 @@ var CameraStatusSchema = z.object({
 	audio: CameraAudioStatusSchema.nullable(),
 	recording: CameraRecordingStatusSchema.nullable(),
 	/**
-	* Per-camera function switches an OPERATOR has turned off
+	* Per-camera functions an OPERATOR has turned off
 	* ([D61](../../../../docs/decisions/adr-0067.md)).
 	*
+	* Composed from the AUTHORITIES themselves — the wrapper bindings,
+	* `RecordingConfig.enabled`, the notification mute, the broker's audio
+	* policy, the camera's own microphone — via `composeSwitchedOff`, not from
+	* the deprecated `getCameraSwitches` group ([D113](../../../../docs/decisions/adr-0113.md)).
+	* The badge outlives the control panel: the panel was a convenience, this is
+	* the difference between a camera being off and a camera being dead.
+	*
 	* This is the difference between DISABLED and BROKEN. A camera whose
 	* `detection` block reports zero fps and whose `switchedOff` contains
 	* `'object-detection'` was switched off by a person; the same camera with an
@@ -16979,6 +17009,10 @@ var pipelineOrchestratorCapability = {
 			agentNodeId: z.string().optional()
 		}), CameraPipelineConfigSchema),
 		/**
+		* @deprecated The aggregate switch group is being withdrawn
+		* ([D113](../../../../docs/decisions/adr-0113.md)). Build nothing new on
+		* this pair; read the authority directly.
+		*
 		* The whole per-camera function switch group, DERIVED — never a stored
 		* list ([D61](../../../../docs/decisions/adr-0067.md)).
 		*
@@ -16992,9 +17026,23 @@ var pipelineOrchestratorCapability = {
 		* `auth: 'view'` deliberately — a NON-admin must be able to see that a
 		* camera is quiet because somebody switched it off. Only the mutation is
 		* admin-gated.
+		*
+		* **Removal plan.** It stays and it KEEPS WORKING while shipped viewers
+		* (v1.0.305) and the admin UI still call it — removing it now is a broken
+		* app on a device nobody can redeploy from here. It is served by a thin
+		* shim over the same authorities (`camera-switch-service.ts`), so the
+		* behaviour of the pair is the behaviour of the authorities by
+		* construction. It is deleted once every surface reaches its own
+		* component's options and the last caller is gone. Nothing on this server
+		* reads it: `CameraStatus.switchedOff` is composed from the authorities
+		* directly via `composeSwitchedOff`.
 		*/
 		getCameraSwitches: method(z.object({ deviceId: z.number() }), CameraSwitchGroupSchema),
 		/**
+		* @deprecated See {@link getCameraSwitches}. Write the authority — the
+		* wrapper binding, `RecordingConfig.enabled`, the notification mute — not
+		* this ([D113](../../../../docs/decisions/adr-0113.md)).
+		*
 		* Flip ONE switch, routed to its existing authority.
 		*
 		* Never writes a parallel map: `recording` patches `RecordingConfig.enabled`
@@ -25225,7 +25273,7 @@ var recordingCapability = {
 	}
 };
 /**
-* `recordingExport` cap — render a footage time range into a single downloadable
+* `recording-export` cap — render a footage time range into a single downloadable
 * MP4 (regular / accelerated / decelerated / timelapse, ± audio), kept for a
 * bounded lifetime with a durable history, auto-expiry, and optional
 * delete-after-download.
@@ -25240,10 +25288,42 @@ var recordingCapability = {
 */
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = z.number().min(.25).max(32);
+/**
+* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* Relative and not absolute epoch on purpose: the renderer's frame-select
+* expression sees ffmpeg's `t`, which starts at 0 for the export's source
+* playlist. Handing it absolute epochs would make every call site responsible
+* for the same subtraction, and the one that forgot would emit a filter that
+* selects nothing — silently, as a uniform timelapse.
+*/
+var ExportDenseRangeSchema = z.object({
+	fromSec: z.number().nonnegative(),
+	toSec: z.number().nonnegative()
+}).refine((r) => r.toSec > r.fromSec, { message: "dense range must have toSec > fromSec" });
+/**
+* Dense-interval overlay for a timelapse: sample at `dense.everyMs` INSIDE the
+* listed ranges and at the base `everyMs` everywhere else.
+*
+* `everyMs` must be strictly smaller than the base cadence — a dense rate that
+* is not denser renders a uniform timelapse the operator believes is two-rate.
+*/
+var ExportDenseSchema = z.object({
+	everyMs: z.number().int().positive(),
+	ranges: z.array(ExportDenseRangeSchema).min(1).max(200)
+});
 /** Timelapse cadence — sample one source frame per `everyMs`, output at `outputFps`. */
 var ExportTimelapseSchema = z.object({
 	everyMs: z.number().int().positive(),
-	outputFps: z.number().int().min(1).max(60).optional()
+	outputFps: z.number().int().min(1).max(60).optional(),
+	/** Optional second, FASTER rate over the intervals that matter. */
+	dense: ExportDenseSchema.optional()
+}).superRefine((v, ctx) => {
+	if (v.dense !== void 0 && v.dense.everyMs >= v.everyMs) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: "dense.everyMs must be strictly smaller than the base everyMs",
+		path: ["dense", "everyMs"]
+	});
 });
 /**
 * Render options. `speed` and `timelapse` are mutually exclusive. `includeAudio`
@@ -25301,8 +25381,21 @@ var ExportDownloadSchema = z.object({
 	url: z.string(),
 	endpoints: z.array(z.string())
 });
+/**
+* A finished export's bytes, inline.
+*
+* `bytes` is the DECODED length — the number the caller bounds and logs
+* against, so nobody has to infer it from the base64 length.
+*/
+var ExportBytesSchema = z.object({
+	base64: z.string(),
+	contentType: z.string(),
+	/** Suggested filename, extension included. */
+	name: z.string(),
+	bytes: z.number().int().nonnegative()
+});
 var recordingExportCapability = {
-	name: "recordingExport",
+	name: "recording-export",
 	scope: "system",
 	mode: "singleton",
 	methods: {
@@ -25340,6 +25433,27 @@ var recordingExportCapability = {
 		getDownloadUrl: method(z.object({ exportId: z.string() }), ExportDownloadSchema, {
 			kind: "query",
 			auth: "protected"
+		}),
+		/**
+		* The finished file's BYTES, base64, for a caller that must republish them
+		* somewhere a session-less fetcher can reach.
+		*
+		* `getDownloadUrl` is the right answer for a human: the download route is
+		* served `access: 'authenticated'`, which a browser satisfies and a
+		* notifier BACKEND does not. It answers a RELATIVE path, so it is not even
+		* a URL an outside fetcher could try. This method exists for the one case
+		* that needs the other thing — a scheduled timelapse whose video has to
+		* become a public attachment on the notification artifact plane.
+		*
+		* Deliberately narrow: `ready` only (a queued, rendering, failed, expired
+		* or deleted export has no file, and answering "0 bytes" for one is how a
+		* caller ships an empty attachment), still inside its lifetime, and under
+		* {@link RECORDING_EXPORT_MAX_READ_BYTES}. Every refusal throws with the
+		* reason — none of them is silent.
+		*/
+		readExportBytes: method(z.object({ exportId: z.string() }), ExportBytesSchema, {
+			kind: "query",
+			auth: "protected"
 		})
 	}
 };
@@ -32028,37 +32142,43 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "create"
 	},
 	"recordingExport.cancelExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
 	"recordingExport.createExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
 	"recordingExport.deleteExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
 	"recordingExport.getDownloadUrl": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
 	"recordingExport.getExport": {
-		capName: "recordingExport",
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
 	"recordingExport.listExports": {
-		capName: "recordingExport",
+		capName: "recording-export",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"recordingExport.readExportBytes": {
+		capName: "recording-export",
 		capScope: "system",
 		addonId: null,
 		access: "view"
@@ -33480,10 +33600,28 @@ TimelapseRuleInputSchema.extend({
 	*/
 	ownerUserId: z.string().optional(),
 	/**
-	* Epoch-ms of the last successful generation — the 1-hour re-generation
-	* guard's durable state (predecessor parity). Absent = never generated.
+	* Epoch-ms of the NEWEST successful generation across every camera of this
+	* rule. What a UI shows, and the compatibility floor for
+	* {@link readTimelapseGeneratedAt}. Absent = never generated.
 	*/
 	lastGeneratedAt: z.number().optional(),
+	/**
+	* PER-CAMERA generation state, keyed by `String(deviceId)` — the
+	* re-generation guard's real durable state.
+	*
+	* One rule covers several cameras and each renders its own video, so a rule
+	* -wide stamp is wrong in the direction that DESTROYS work: camera A
+	* succeeding at 06:05 tells camera B, whose render failed, that it is
+	* already done — and B's night is gone for good, because the window will not
+	* come back.
+	*
+	* ADDITIVE, so the migration is free: a row written before this field simply
+	* has no map, and {@link readTimelapseGeneratedAt} falls back to
+	* {@link TimelapseRuleSchema.shape.lastGeneratedAt}. Reading an old row as
+	* "never generated" would re-render and re-notify every camera of every rule
+	* once, on the deploy that shipped the map.
+	*/
+	generatedByDevice: z.record(z.string(), z.number()).optional(),
 	/** userId of the caller who created the rule (server-stamped). */
 	createdBy: z.string(),
 	createdAt: z.number(),